Merge pull request #15 from BitcoinErrorLog/phase1-security-hardening

Phase 1: Add rate limiting and enhance error types

Author: BitcoinErrorLog

examples/storage_queue.rs

@@ -75,9 +75,15 @@ fn main() {
     let default_config = RetryConfig::default();
     println!("   Default config:");
     println!("     max_retries: {}", default_config.max_retries);
-    println!("     initial_backoff_ms: {}", default_config.initial_backoff_ms);
+    println!(
+        "     initial_backoff_ms: {}",
+        default_config.initial_backoff_ms
+    );
     println!("     max_backoff_ms: {}", default_config.max_backoff_ms);
-    println!("     operation_timeout_ms: {}", default_config.operation_timeout_ms);
+    println!(
+        "     operation_timeout_ms: {}",
+        default_config.operation_timeout_ms
+    );
 
     // Custom retry configuration for different scenarios
     let aggressive_config = RetryConfig {
@@ -96,11 +102,17 @@ fn main() {
 
     println!("\n   Aggressive config (quick retries):");
     println!("     max_retries: {}", aggressive_config.max_retries);
-    println!("     initial_backoff_ms: {}", aggressive_config.initial_backoff_ms);
+    println!(
+        "     initial_backoff_ms: {}",
+        aggressive_config.initial_backoff_ms
+    );
 
     println!("\n   Conservative config (patient retries):");
     println!("     max_retries: {}", conservative_config.max_retries);
-    println!("     initial_backoff_ms: {}", conservative_config.initial_backoff_ms);
+    println!(
+        "     initial_backoff_ms: {}",
+        conservative_config.initial_backoff_ms
+    );
 
     // =========================================================================
     // Storage-Backed Messaging Setup
@@ -197,9 +209,9 @@ fn main() {
     println!("   // Receive messages (polls peer's repository)");
     println!("   let messages = messaging.receive_messages(Some(10)).await?;");
     println!("\n   // Process each message");
-    println!("   for message in messages {");
-    println!("       println!(\"Received: {:?}\", message);");
-    println!("   }");
+    println!("   for message in messages {{");
+    println!("       println!(\"Received: {{:?}}\", message);");
+    println!("   }}");
     println!("\n   // Get updated counter for persistence");
     println!("   let counter = messaging.read_counter();");
     println!("   persist_counter(counter);");
@@ -222,9 +234,9 @@ fn main() {
     println!("   // Enqueue a message");
     println!("   messaging.enqueue(b\"Hello\").await?;");
     println!("\n   // Dequeue messages");
-    println!("   while let Some(message) = messaging.dequeue().await? {");
+    println!("   while let Some(message) = messaging.dequeue().await? {{");
     println!("       process_message(message);");
-    println!("   }");
+    println!("   }}");
     println!("   ```");
 
     // =========================================================================
@@ -240,13 +252,13 @@ fn main() {
 
     println!("\n   Error handling pattern:");
     println!("   ```rust");
-    println!("   match messaging.send_message(data).await {");
+    println!("   match messaging.send_message(data).await {{");
     println!("       Ok(_) => println!(\"Message sent\"),");
-    println!("       Err(NoiseError::Storage(msg)) => {");
+    println!("       Err(NoiseError::Storage(msg)) => {{");
     println!("           // Retry or handle storage error");
-    println!("       }");
+    println!("       }}");
     println!("       Err(e) => handle_error(e),");
-    println!("   }");
+    println!("   }}");
     println!("   ```");
 
     // =========================================================================

src/errors.rs

@@ -18,12 +18,20 @@ pub enum NoiseErrorCode {
     RemoteStaticMissing = 5001,
     /// Policy violation
     Policy = 6000,
+    /// Rate limited
+    RateLimited = 6001,
+    /// Maximum sessions exceeded
+    MaxSessionsExceeded = 6002,
+    /// Session expired or not found
+    SessionExpired = 6003,
     /// Invalid peer key
     InvalidPeerKey = 7000,
     /// Network error
     Network = 8000,
     /// Timeout error
     Timeout = 8001,
+    /// Connection reset
+    ConnectionReset = 8002,
     /// Storage error
     Storage = 9000,
     /// Decryption error
@@ -55,6 +63,15 @@ pub enum NoiseError {
     #[error("policy violation: {0}")]
     Policy(String),
 
+    #[error("rate limited: {0}")]
+    RateLimited(String),
+
+    #[error("maximum sessions exceeded for this identity")]
+    MaxSessionsExceeded,
+
+    #[error("session expired or not found: {0}")]
+    SessionExpired(String),
+
     #[error("invalid peer static or shared secret")]
     InvalidPeerKey,
 
@@ -64,6 +81,9 @@ pub enum NoiseError {
     #[error("timeout: {0}")]
     Timeout(String),
 
+    #[error("connection reset: {0}")]
+    ConnectionReset(String),
+
     #[error("storage error: {0}")]
     Storage(String),
 
@@ -85,9 +105,13 @@ impl NoiseError {
             Self::IdentityVerify => NoiseErrorCode::IdentityVerify,
             Self::RemoteStaticMissing => NoiseErrorCode::RemoteStaticMissing,
             Self::Policy(_) => NoiseErrorCode::Policy,
+            Self::RateLimited(_) => NoiseErrorCode::RateLimited,
+            Self::MaxSessionsExceeded => NoiseErrorCode::MaxSessionsExceeded,
+            Self::SessionExpired(_) => NoiseErrorCode::SessionExpired,
             Self::InvalidPeerKey => NoiseErrorCode::InvalidPeerKey,
             Self::Network(_) => NoiseErrorCode::Network,
             Self::Timeout(_) => NoiseErrorCode::Timeout,
+            Self::ConnectionReset(_) => NoiseErrorCode::ConnectionReset,
             Self::Storage(_) => NoiseErrorCode::Storage,
             Self::Decryption(_) => NoiseErrorCode::Decryption,
             Self::Other(_) => NoiseErrorCode::Other,
@@ -98,6 +122,31 @@ impl NoiseError {
     pub fn message(&self) -> String {
         self.to_string()
     }
+
+    /// Returns true if this error is potentially recoverable by retrying.
+    pub fn is_retryable(&self) -> bool {
+        matches!(
+            self,
+            Self::Network(_)
+                | Self::Timeout(_)
+                | Self::ConnectionReset(_)
+                | Self::RateLimited(_)
+                | Self::Storage(_)
+        )
+    }
+
+    /// Returns a suggested retry delay in milliseconds, if applicable.
+    pub fn retry_after_ms(&self) -> Option<u64> {
+        match self {
+            Self::RateLimited(msg) => {
+                // Try to parse retry-after from message if encoded
+                msg.parse().ok()
+            }
+            Self::Network(_) | Self::Timeout(_) | Self::ConnectionReset(_) => Some(1000),
+            Self::Storage(_) => Some(500),
+            _ => None,
+        }
+    }
 }
 
 impl From<snow::Error> for NoiseError {

src/lib.rs

@@ -33,6 +33,7 @@ pub mod mobile_manager;
 pub mod pkarr;
 #[cfg(feature = "pubky-sdk")]
 pub mod pubky_ring;
+pub mod rate_limiter;
 pub mod ring;
 pub mod server;
 pub mod session_id;
@@ -51,8 +52,9 @@ pub use mobile_manager::{ConnectionStatus, MobileConfig, NoiseManager, SessionSt
 pub use pkarr::{DummyPkarr, PkarrNoiseRecord, PkarrResolver};
 #[cfg(feature = "pubky-sdk")]
 pub use pubky_ring::PubkyRingProvider;
+pub use rate_limiter::{RateLimitReason, RateLimitResult, RateLimiter, RateLimiterConfig};
 pub use ring::{DummyRing, RingKeyFiller, RingKeyProvider};
-pub use server::NoiseServer;
+pub use server::{NoiseServer, ServerPolicy};
 pub use session_id::SessionId;
 pub use session_manager::{NoiseRole, NoiseSessionManager, ThreadSafeSessionManager};
 #[cfg(feature = "storage-queue")]